Firewall filtering want to make sure i understand this

[kcray]

I am teaching myself firewall filtering on a couple of ex switches and wanted to verify my understanding of how the filter would procces the 2 terms below that are part of one filter.

term  term-one {

          From {

                     source-mac-address { 00:00:01:e1:de:00:be/48;

                      {

                    source-address  {192.168.1.18/32;

                      }

                    }

            then {

                       discard;

                        syslog;

                     }

                      }  

term term-two {

                          then {

                                     accept;

                             }

                          }

if source-address and source-mac-address match in term-one then it will discard the packet and generate a syslog message.  and if it does not match in term-one , then the rest of traffic should match in term-two  and be accept.

[martinbrown2k]

Yes, it would do as you said, however, why would you want to?  In the real world, the MAC address should be unique, so there would be no need to have both options present.

If you didn't apply the second term, then you would have an implicit deny as well, so putting the second term covers all other traffic, so well done.

I'm not sure if you have seen the fasttrack learning resources, however, in the

JNCIS-ENT Switching Study Guide, chapter 5 details firewall filters on EX switches and where you can apply them.  You can access them here:  https://learningportal.juniper.net/juniper/user_fasttrack_home.aspx.  They are located under the JNCIS section.

[erdems]

Hey there,

 Reading this filter, I would assume there is a constraint between the mac (physical device) and IP address, potentially some redundancy/backup_mode enforcing; hence including both as a from statement.

 Cheers,